13595 matches found
CVE-2024-8063
CVE-2024-8063 concerns Ollama/ollama before or at v0.3.3. A vulnerability arises when importing GGUF models with a crafted type for the block_count field in the Modelfile, causing a divide-by-zero error that leads to a DoS (server crash) when processing the model. The associated connected data co...
CVE-2024-8063 Divide by Zero in ollama/ollama
A divide by zero vulnerability exists in ollama/ollama version v0.3.3. The vulnerability occurs when importing GGUF models with a crafted type for blockcount in the Modelfile. This can lead to a denial of service DoS condition when the server processes the model, causing it to crash...
CVE-2025-0312 NULL Pointer Dereference in ollama/ollama
A vulnerability in ollama/ollama versions =0.3.14 allows a malicious user to create a customized GGUF model file that, when uploaded and created on the Ollama server, can cause a crash due to an unchecked null pointer dereference. This can lead to a Denial of Service DoS attack via remote network...
CVE-2025-0312
CVE-2025-0312 describes a DoS in ollama/ollama
CVE-2025-0312 NULL Pointer Dereference in ollama/ollama
A vulnerability in ollama/ollama versions =0.3.14 allows a malicious user to create a customized GGUF model file that, when uploaded and created on the Ollama server, can cause a crash due to an unchecked null pointer dereference. This can lead to a Denial of Service DoS attack via remote network...
CVE-2024-8616 Arbitrary File Overwrite in h2oai/h2o-3
In h2oai/h2o-3 version 3.46.0, the /99/Models/name/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for...
CVE-2025-0317
CVE-2025-0317 affects the Ollama stack: versions
CVE-2025-0317 Divide By Zero in ollama/ollama
A vulnerability in ollama/ollama versions =0.3.14 allows a malicious user to upload and create a customized GGUF model file on the Ollama server. This can lead to a division by zero error in the ggufPadding function, causing the server to crash and resulting in a Denial of Service DoS attack...
CVE-2025-0317 Divide By Zero in ollama/ollama
A vulnerability in ollama/ollama versions =0.3.14 allows a malicious user to upload and create a customized GGUF model file on the Ollama server. This can lead to a division by zero error in the ggufPadding function, causing the server to crash and resulting in a Denial of Service DoS attack...
CVE-2024-6854
CVE-2024-6854 affects h2oai/h2o-3 (v3.46.0). The export-model endpoint does not restrict the destination path, enabling an attacker to export a model to arbitrary locations on the server’s filesystem and overwrite files. The overwrite target content is not controllable by the attacker, but the at...
CVE-2024-6854 Arbitrary File Overwrite in h2oai/h2o-3
In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a...
CVE-2025-0315
CVE-2025-0315 affects Ollama (github.com/ollama/ollama) versions
CVE-2025-0315 Allocation of Resources Without Limits or Throttling in ollama/ollama
A vulnerability in ollama/ollama =0.3.14 allows a malicious user to create a customized GGUF model file, upload it to the Ollama server, and create it. This can cause the server to allocate unlimited memory, leading to a Denial of Service DoS attack...
CVE-2024-7990
CVE-2024-7990 is rejected/not used; this CVE ID does not represent an active vulnerability entry.
CVE-2024-7990 Stored Cross-Site Scripting in open-webui/open-webui
A stored cross-site scripting XSS vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious...
CVE-2024-10273
CVE-2024-10273 affects lunary-ai/lunary v1.5.0. The vulnerability stems from improper privilege management in the models.ts file, where the PATCH endpoint lacks sufficient privilege checks, allowing users with a viewer role to modify models owned by others. The impact is unauthorized changes to c...
CVE-2024-12055 DoS using malicious gguf model file in ollama/ollama
A vulnerability in Ollama versions =0.3.14 allows a malicious user to create a customized gguf model file that can be uploaded to the public Ollama server. When the server processes this malicious model, it crashes, leading to a Denial of Service DoS attack. The root cause of the issue is an...
CVE-2024-12055 DoS using malicious gguf model file in ollama/ollama
A vulnerability in Ollama versions =0.3.14 allows a malicious user to create a customized gguf model file that can be uploaded to the public Ollama server. When the server processes this malicious model, it crashes, leading to a Denial of Service DoS attack. The root cause of the issue is an...